Php - vulnerabilities (CVEs)

783 CVEs in 37 products, 4 in the last 30 days, newest from 2026-10-21.

Products

• Php - 740 CVEs
• Archive Tar - 5 CVEs
• Frankenphp - 5 CVEs
• Pear - 5 CVEs
• Student Enrollment - 3 CVEs
• Best Courier Management System - 2 CVEs
• Pearweb - 2 CVEs
• Php Script Index - 2 CVEs
• Animated Smiley Generator - 1 CVEs
• Ar Memberscript - 1 CVEs
• Best House Rental Management System - 1 CVEs
• Blog Cms - 1 CVEs
• Bloq - 1 CVEs
• Com Extensions - 1 CVEs
• Directory Listing Script - 1 CVEs
• Errordocs - 1 CVEs
• Ext-http - 1 CVEs
• F1 Maxs File Uploader - 1 CVEs
• Imagick - 1 CVEs
• Memcached - 1 CVEs
• Mysql Banner Exchange - 1 CVEs
• Mysql Extension - 1 CVEs
• Pear Archive Tar - 1 CVEs
• Pecl Http - 1 CVEs
• Php Fi - 1 CVEs
• Phpsquidpass - 1 CVEs
• Xhprof - 1 CVEs
• Xml Rpc - 1 CVEs
• Comoblog - 0 CVEs
• Cvs - 0 CVEs
• Dirlist - 0 CVEs
• Easymoblog - 0 CVEs
• Go-pear.php - 0 CVEs
• Pecl Phpdoc - 0 CVEs
• Phorum - 0 CVEs
• Php123 Top Sites - 0 CVEs
• Phpbookingcalendar - 0 CVEs

Newest CVEs of Php

• CVE-2026-109619 - CVSS 9.2 (critical), 2026-10-21: PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated…
• CVE-2026-109618 - CVSS 9.8 (critical), 2026-10-21: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for…
• CVE-2026-85733 - CVSS 5.3 (medium), 2026-10-13: FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default…
• CVE-2026-82416 - CVSS 7.7 (high), 2026-10-13: FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session…
• CVE-2026-92842 - CVSS 5.9 (medium), 2026-09-25: The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is…
• CVE-2026-91768 - CVSS 6.5 (medium), 2026-09-25: The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96…
• CVE-2026-91769 - CVSS 4.3 (medium), 2026-09-25: PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name.…
• CVE-2026-91767 - CVSS 6.5 (medium), 2026-09-25: php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a…
• CVE-2025-1218 - CVSS 5.9 (medium), 2026-09-25: The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or…
• CVE-2026-91766 - CVSS 5.9 (medium), 2026-09-25: When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when…
• CVE-2026-91765 - CVSS 7.5 (high), 2026-09-25: cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request…
• CVE-2025-14181 - CVSS 6.5 (medium), 2026-09-25: The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed…
• CVE-2026-17545 - CVSS 7.5 (high), 2026-09-25: On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$…
• CVE-2026-6103 - CVSS 4.3 (medium), 2026-09-25: phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to…
• CVE-2026-93682 - CVSS 5.8 (medium), 2026-09-25: When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end…
• CVE-2026-7260 - CVSS 5.5 (medium), 2026-07-30: Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.*…
• CVE-2026-17544 - CVSS 9.8 (critical), 2026-07-30: Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from…
• CVE-2026-17543 - CVSS 9.8 (critical), 2026-07-30: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.*…
• CVE-2026-14355 - CVSS 5.6 (medium), 2026-07-03: In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL…
• CVE-2026-45062 - CVSS 8.1 (high), 2026-06-10: FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses…
• CVE-2026-7263 - CVSS 7.5 (high), 2026-05-10: In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the…
• CVE-2026-6104 - CVSS 9.1 (critical), 2026-05-10: In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or…
• CVE-2026-7261 - CVSS 9.8 (critical), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with…
• CVE-2026-6722 - CVSS 9.8 (critical), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism…
• CVE-2026-7259 - CVSS 6.5 (medium), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl…
• CVE-2026-7568 - CVSS 7.5 (high), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c…
• CVE-2026-7258 - CVSS 7.5 (high), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char…
• CVE-2026-7262 - CVSS 7.5 (high), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the…
• CVE-2026-6735 - CVSS 7.3 (high), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an…
• CVE-2025-14179 - CVSS 9.8 (critical), 2026-05-10: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes…